{"record":{"id":"9d1c91709defee77","repo":"hashicorp/packer","slug":"decode-sigstore-bundle-w","errorCode":null,"errorMessage":"decode Sigstore bundle: %w","messagePattern":"decode Sigstore bundle: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":178,"sourceCode":"\t\t}\n\n\t\ttrustedMaterial, err := loadKeylessTrustedMaterial(cfg)\n\t\tif err != nil {\n\t\t\treturn Envelope{}, nil, fmt.Errorf(\"load keyless trusted root: %w\", err)\n\t\t}\n\n\t\toptions.TransparencyLogs = []sigstoregosign.Transparency{newKeylessRekor(rekorURL)}\n\t\toptions.TrustedRoot = trustedMaterial\n\t}\n\n\tprotobufBundle, err := newKeylessBundle(content, s.keypair, options)\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"build Sigstore bundle: %w\", err)\n\t}\n\n\tbundleWrapper, err := sigstorebundle.NewBundle(protobufBundle)\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"decode Sigstore bundle: %w\", err)\n\t}\n\n\tbundleEnvelope, err := bundleWrapper.Envelope()\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"extract envelope from Sigstore bundle: %w\", err)\n\t}\n\n\trawEnvelope := bundleEnvelope.RawEnvelope()\n\tif rawEnvelope == nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"sigstore bundle does not contain a DSSE envelope\")\n\t}\n\n\tbundleJSON, err := bundleWrapper.MarshalJSON()\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"marshal Sigstore bundle: %w\", err)\n\t}\n\n\tenvelope := Envelope{","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L160-L196","documentation":"After sigstoregosign.Bundle produces a protobuf bundle, it is wrapped via sigstorebundle.NewBundle to get the typed bundle API; failure here means the generated protobuf bundle could not be validated/decoded into the sigstore-go bundle type. Given the bundle was just constructed locally, this indicates a library-version mismatch or malformed bundle content (e.g. missing verification material) rather than user configuration.","triggerScenarios":"SignBundle calls sigstorebundle.NewBundle(protobufBundle) at internal/attestation/sign_keyless.go:176-178 immediately after successful bundle construction; fails if the protobuf bundle is invalid per sigstore-go's decoder (rare; typically only with mismatched sigstore-go package versions or an upstream bug).","commonSituations":"Mixed sigstore-go module versions (vendor/replace or go.mod mismatch between protoutil/sign packages); a mocked newKeylessBundle in tests returning an incomplete bundle; upstream sigstore-go regression.","solutions":["Run go mod tidy / go mod verify to ensure a single consistent sigstore-go version in the build","Upgrade sigstore-go to the latest patch release and retry","Retry the operation to rule out nondeterministic construction issues","If in a test with a stubbed newKeylessBundle, make the stub return a fully valid protobuf bundle"],"exampleFix":"// before\nrequire github.com/sigstore/sigstore-go v0.x.0 // stale, mismatched helpers\n// after\ngo get github.com/sigstore/sigstore-go@latest && go mod tidy","handlingStrategy":"validation","validationCode":"// keep a single consistent sigstore-go version\nout, err := exec.Command(\"go\", \"mod\", \"verify\").CombinedOutput()\nif err != nil || strings.Contains(string(out), \"FAILED\") {\n\treturn fmt.Errorf(\"module verification failed: %s\", out)\n}","typeGuard":null,"tryCatchPattern":"envelope, bundle, err := signer.SignBundle(ctx, ptype, payload, cfg)\nif err != nil && strings.Contains(err.Error(), \"decode Sigstore bundle\") {\n\treturn fmt.Errorf(\"library inconsistency producing invalid bundle; upgrade sigstore-go: %w\", err)\n}","preventionTips":["Avoid go.mod replace directives fragmenting sigstore-go versions","Run go mod tidy/verify in CI","Keep sigstore-go current"],"tags":["go","sigstore","bundle","library-version"],"backgroundTag":"bundle-decode-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}